Author: Rachel Roldan, Senior Director of Product Management 

I’m excited to share with our customers that coming soon, Triage will offer a new, AI-powered Spam Filtering feature within our Triage Phishing Analysis product.  

Triage Custom AI Spam filtering is an optional add-on feature that uses a Bayesian Machine Learning model to deliver spam filtering that is private to and bespoke for each customer. We call it a Custom AI solution because the model is trained on a per-customer basis. We are currently planning to release this feature for Triage users at the end of September. If you’re interested in learning more about this upcoming capability, contact your Cofense CX and Solutions Engineering team. 

The Spam Filtering Challenge 

Spam is a costly distraction for SOCs. Spam constitutes at least 30% of the emails that get through SEGs (Secure Email Gateways) and other filters. In the Cofense Phishing Defense Center (PDC), our global, follow-the-sun email security SOC operation that provides managed email security services for millions of employees, the percentage of spam emails is higher— at 44%. Spam creates a costly burden on SOC analysts and impacts their ability to focus on security analysis. In fact, one SMB enterprise customer told us that they devote the equivalent of a Full Time Employee (FTE) in SOC analyst time just to deal with spam emails. 

This is why effective spam filtering is so relevant to SOC operations. However, accuracy matters a lot. For example, over-zealous filtering can block legitimate emails, and lead to unwanted scrutiny, rollback work, and post-mortems that can be just as time-consuming and distracting as spam itself. 

The challenge, then, is to ensure the highest effectiveness in reducing SOC analyst workloads with the highest accuracy. 

Enter Triage Custom AI Spam Filtering 

AI has exploded recently with the promise of efficient and intelligent answers derived from vast sources of data. While we have great hopes for the future, we remain grounded in the present and realize that specific problems require specific solutions.  

Triage Custom AI Spam Filtering (AISF) addresses the challenges faced by SOC analysts daily while staying away from the latest flashy iterations of AI and focusing on a fundamental machine learning algorithm. Triage AISF leverages Bayes’ algorithm to efficiently score and identify emails that are like previously received spam messages.  

Training of the model starts the second you turn on the feature, select which categories are spam and business communications, and start to categorize emails. If you’re a current Triage customer with data already on your host, all emails matching the categories selected can be used to pre-train the model with work you have already done. Once you are confident in the model’s performance and have determined an effective baseline spam score, automation can be enabled to process and categorize any reports that exceed the threshold. 

A transparent, performant, privacy-oriented approach to AI 

One of the big current complaints in the cybersecurity market is the unrestrained marketing of mysterious (and sometimes unprovable) forms of AI and ML. With this productization of ML in our solutions, we decided to be forthcoming about what we’re using (Bayes algorithm) to allay these concerns.  

One of the concerns that often comes up when AI & ML are mentioned, is performance. Will you need a GPU farm to run it? The good news here is that using a lightweight ML algorithm like Bayes means there’s no requirement for any specialized hardware. Based on our testing thus far, we expect this feature to work well without any undue pressure on the performance of your existing Triage deployment.  

Finally, many vendors avoid discussion about what happens to your data. We’re all aware of the pitfalls of sharing private or sensitive company data with AI products that subsume and repackage it into public-facing information. So, I want to be clear that with Triage AISF, your emails don’t go to our cloud or any cloud, they stay within your enterprise. You retain ownership and control of your data, and the model training stays yours as well. 

AI + Human-Vetted Intelligence at Scale 

One of the things that you may not be aware of is that Cofense has been training models for some time and already extensively uses AI/ML to produce its threat intelligence service. We’re big believers in AI/ML to enhance productivity and velocity. But we’re also big believers that AI models alone are not enough to secure your email. Why? Very simply, because the bad guys have AI too. That means they can innovate far more rapidly than ever before. No defensive AI model on its own will ever be able to fully close that gap. That’s why we believe the future of email protection involves both AI/ML and human-vetted intelligence at scale. 

Triage Custom AI Spam Filtering will be our first productization of AI/ML, but it won’t be our last. We’re excited for this journey and to help our customers build more efficient SOC operations, and a more secure enterprise.